Fixed type inference (ASSIGN_OP with typed reference may cause type conversion)

Author: dstogov

ext/opcache/Optimizer/zend_inference.c

@@ -2614,6 +2614,10 @@ static zend_always_inline int _zend_update_type_info(
 						 * results in a null return value. */
 						tmp |= MAY_BE_NULL;
 					}
+					if (tmp & MAY_BE_REF) {
+						/* Typed reference may cause auto conversion */
+						tmp |= MAY_BE_ANY;
+					}
 				} else if (opline->opcode == ZEND_ASSIGN_OBJ_OP) {
 					/* The return value must also satisfy the property type */
 					if (prop_info) {
@@ -2624,6 +2628,11 @@ static zend_always_inline int _zend_update_type_info(
 					if (prop_info) {
 						tmp &= zend_fetch_prop_type(script, prop_info, NULL);
 					}
+				} else {
+					if (tmp & MAY_BE_REF) {
+						/* Typed reference may cause auto conversion */
+						tmp |= MAY_BE_ANY;
+					}
 				}
 				tmp &= ~MAY_BE_REF;
 				UPDATE_SSA_TYPE(tmp, ssa_op->result_def);

ext/opcache/tests/jit/assign_op_002.phpt

@@ -0,0 +1,21 @@
+--TEST--
+JIT ASSIGN_OP: 002
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+--FILE--
+<?php
+class Test {
+    public ?string $prop = "0";
+}
+function test() {
+    $obj = new Test;
+    $ref =& $obj->prop;
+    var_dump($ref &= 1);
+}
+test();
+?>
+--EXPECT--
+string(1) "0"